docs: def download_pac(candidate_urls, timeout=1, allowed_content_types=None):
      """
      Try to download a PAC file from one of the given candidate URLs.
  
      :param list[str] candidate_urls: URLs that are expected to return a PAC file.
          Requests are made in order, one by one.
      :param timeout: Time to wait for host resolution and response for each URL.
          When a timeout or DNS failure occurs, the next candidate URL is tried.
      :param allowed_content_types: If the response has a ``Content-Type`` header,
          then consider the response to be a PAC file only if the header is one of these values.
          If not specified, the allowed types are
          ``application/x-ns-proxy-autoconfig`` and ``application/x-javascript-config``.
      :return: Contents of the PAC file, or `None` if no URL was successful.
      :rtype: str|None
      """
      if not allowed_content_types:
          allowed_content_types = {'application/x-ns-proxy-autoconfig', 'application/x-javascript-config'}
  
      sess = requests.Session()
      sess.trust_env = False  # Don't inherit proxy config from environment variables.
      for pac_url in candidate_urls:
          try:
              resp = sess.get(pac_url, timeout=timeout)
              content_type = resp.headers.get('content-type', '').lower()
              if content_type and True not in [allowed_type in content_type for allowed_type in allowed_content_types]:
                  continue
              if resp.ok:
                  return resp.text
          except (requests.exceptions.ConnectionError, requests.exceptions.Timeout):
              continue